#!/usr/bin/env bash
#
# Retroactively harden php-fpm against dnf updates clobbering our customizations.
#
# Background: setup.sh historically did two things that don't survive a dnf
# update of the php-fpm package:
#   1. sed-edited /lib/systemd/system/php-fpm.service to add `-R --nodaemonize`.
#      That file is owned by the package and gets restored on update, so the
#      master process loses root and fails to manage user pools.
#   2. `rm -f /etc/php-fpm.d/www.conf`. RPM's %config(noreplace) only protects
#      *modified* config files, not deleted ones — so dnf re-adds www.conf on
#      update and the default pool conflicts with our php-fpm-whp.conf.
#
# Fix:
#   1. Install a systemd drop-in at /etc/systemd/system/php-fpm.service.d/override.conf.
#      Drop-ins live outside any package's file list and are never touched by dnf.
#      The drop-in's empty `ExecStart=` clears whatever the shipped unit defines,
#      then the second ExecStart sets ours — so the shipped unit's contents
#      become irrelevant. No need to revert the historical sed edit.
#   2. Truncate www.conf to empty instead of deleting it. %config(noreplace)
#      then leaves our (empty) version alone forever.
#
# Idempotent: safe to re-run. Only daemon-reloads / restarts php-fpm if
# something actually changed.

set -euo pipefail

OVERRIDE_DIR="/etc/systemd/system/php-fpm.service.d"
OVERRIDE_FILE="${OVERRIDE_DIR}/override.conf"
WWW_CONF="/etc/php-fpm.d/www.conf"

changed=0

# 1. Install/refresh the systemd drop-in
desired_override=$(cat <<'EOF'
[Service]
ExecStart=
ExecStart=/usr/sbin/php-fpm -R --nodaemonize
User=root
Group=root
EOF
)

mkdir -p "$OVERRIDE_DIR"
if [[ ! -f "$OVERRIDE_FILE" ]] || ! diff -q <(printf '%s\n' "$desired_override") "$OVERRIDE_FILE" >/dev/null 2>&1; then
    printf '%s\n' "$desired_override" > "$OVERRIDE_FILE"
    chmod 0644 "$OVERRIDE_FILE"
    echo "Installed/updated $OVERRIDE_FILE"
    changed=1
else
    echo "$OVERRIDE_FILE already current"
fi

# 2. Empty (don't delete) www.conf so %config(noreplace) protects it
if [[ -f "$WWW_CONF" ]]; then
    if [[ -s "$WWW_CONF" ]]; then
        : > "$WWW_CONF"
        echo "Emptied $WWW_CONF"
        changed=1
    else
        echo "$WWW_CONF already empty"
    fi
else
    # File is currently absent (deleted by old setup.sh). Re-create it empty
    # so the next dnf transaction sees a %config(noreplace) match and leaves
    # it alone.
    : > "$WWW_CONF"
    chmod 0644 "$WWW_CONF"
    echo "Re-created $WWW_CONF as empty placeholder"
    changed=1
fi

if [[ "$changed" -eq 1 ]]; then
    systemctl daemon-reload
    if systemctl is-active --quiet php-fpm; then
        systemctl restart php-fpm
        echo "Restarted php-fpm"
    fi
    # Verify php-fpm master is running as root after the change
    if systemctl is-active --quiet php-fpm; then
        main_pid=$(systemctl show -p MainPID --value php-fpm)
        if [[ -n "$main_pid" && "$main_pid" != "0" ]]; then
            master_uid=$(ps -o uid= -p "$main_pid" 2>/dev/null | tr -d ' ' || true)
            if [[ -n "$master_uid" && "$master_uid" != "0" ]]; then
                echo "WARNING: php-fpm master is not running as root (uid=$master_uid)" >&2
                exit 1
            fi
            echo "php-fpm master running as root, drop-in active"
        fi
    fi
else
    echo "No changes needed; php-fpm hardening already in place"
fi
